Release exact Forensics restriction adapter with public weights, layer/strength evidence, controls and Gemma terms

9fbaf4c verified 6 days ago

6.39 kB

---
license: gemma
base_model: google/gemma-3-1b-it
library_name: peft
language:
- en
tags:
- lora
- interpretability
- instruction-following
- research
---
# Restriction Learning Experiment

The **actual selective-restriction Gemma 3 1B adapter** used by [LoRA-Forensics](https://huggingface.co/spaces/itsalissonsilva/LoRA-Forensics), [Neural-Steering-Lab](https://huggingface.co/spaces/itsalissonsilva/Neural-Steering-Lab) and [Circuit-Scope](https://huggingface.co/spaces/itsalissonsilva/Circuit-Scope). Public weights make their measured layer/strength/intervention experiments reproducible without access to a private adapter.

The question is narrow: **does the model withhold marked-private workspace values while still answering permitted requests?** Every condition receives the same explicit policy. All workspaces and private values are synthetic. This is not a real access-control system, privacy guarantee or general safety model.

## What it learned, and where it failed

96 fixed requests: 84 policy cases from 12 held-out workspaces, eight public-label flips and four unrelated questions.

| Condition | Pass exact automatic checks | Allowed assistance checks | Disclosures |
|---|---:|---:|---:|
| Base Gemma | 28/96 | 28/48 | 4 |
| Selective adapter (root weights) | **75/96** | **39/48** | 3 |
| Blanket-refusal adapter | 36/96 | 0/48 | **0** |
| Matched random adapter | 25/96 | 25/48 | 4 |

**The selective adapter introduces three indirect disclosures on cases where the base did not disclose.** Its lower total disclosure count does not mean it fixed every base failure. It passes only 3/12 ambiguity/clarification cases and 3/4 unrelated questions, compared with 4/4 unrelated answers for base Gemma. Its permitted-task gains coexist with specific regressions.

Disclosure checks cover literal, reversed, base64 and whitespace-normalized synthetic canaries. Allowed-answer/content checks and structured validity are finite automatic proxies, not human-rated usefulness or an exhaustive attack evaluation. The blanket control demonstrates why fewer disclosures alone is an inadequate objective.

## Training and controls

Base revision `dcc83ea841ab6100d6b47a070329e1ba4cf78752`; rank16 Q/V LoRA, two fixed epochs, one seed, 784 examples (112 training workspaces × seven request types). Selective and blanket-refusal adapters start from identical initialization. Development examples were unused; the fixed epoch schedule was not selected on the test.

Held-out templates and table/JSON record layouts test limited generalization. They do not establish transfer to policy omission, other languages, real documents, arbitrary private facts or tools. The model performs text generation only and enforces no external authorization.

`selective/` preserves the original selective checkpoint; root weights are an identical copy for standard PEFT loading. `blanket/` preserves the over-refusal control. The matched random adapter is reconstructed from its fixed seed and module-wise delta Frobenius norms in the training source.

## Layer and strength analysis

`analysis/analysis.json` records five strengths, 26 single-layer removals, 27 hidden-state comparisons and 52 module spectra. Reference-answer likelihood and drift use all 84 policy cases; generated intervention checks use a separate fixed 14-case subset. Likelihood includes one target wording/JSON format and is not a standalone safety score. Large weight updates or representation drift do not alone establish causality.

Matched-batch restoration gives 14/14 identical raw responses and exact likelihood restoration. The original cross-batch capture matched 13/14 raw outputs (14/14 graded outcomes), so batch-composition sensitivity is retained in the provenance.

`interpretability_patchfix/patching.json` is the corrected generation-prefill causal-patching capture with **208/208** exact raw self-restorations. The earlier ordinary-forward/final-normalization patch rows in `interpretability/results.json` are superseded and must not be used as valid patching evidence. Steering/probe measurements in that file remain separate experiments.

This is descriptive follow-up on already opened test data, with no significance or complete-circuit claim. The strongest evidence is the actual base/control/adapted response record, including its failures.

## Run it

Accept Gemma's base-model access terms and authenticate. Reproduction environment: PyTorch2.6.0, Transformers4.57.1, PEFT0.17.1, Accelerate1.10.1, SentencePiece0.2.1. Recorded GPU evaluation uses bfloat16; exact parity depends on the same batch/attention settings.

Download `restriction.py`, then reproduce a permitted case:

```python
import json
from huggingface_hub import hf_hub_download
from restriction import RestrictionModel
repo = "itsalissonsilva/Restriction-Learning-Experiment"
report = json.load(open(hf_hub_download(repo, "restriction_results.json")))
case = next(row for row in report["rows"] if row["kind"] == "public")
print(case["context"], case["request"])
model = RestrictionModel()  # Pin revision to a release commit for a frozen run.
print(model.respond_rows([case])[0])
```

For a new synthetic case, provide `context`, `request` and optionally `policy` in the same record format. The helper returns raw generated JSON-like text, not a guaranteed valid action or an authorization decision. It rejects overly long input rather than truncating the policy. CPU float32 is a different configuration from recorded GPU measurements.

## Reproduce and license

Training, data generation/grading, analysis, restoration, steering and corrected patching sources are included with fixed model revisions and measured results. The Spaces are restrained cached viewers; changing a control selects an existing recorded run. They do not run live inference.

Research inspiration: [Meng et al., ROME / CounterFact](https://rome.baulab.info/) and its efficacy/generalization/specificity criteria. This is LoRA restriction training, not a reproduction of ROME's factual MLP editing method.

Modified artifact notice: the adapter weights were trained by itsalissonsilva and modify Gemma. Gemma and this derivative are subject to the included Gemma Terms of Use and Section3.2 restrictions, including the incorporated Prohibited Use Policy. See `LICENSE`, `NOTICE` and `GEMMA_PROHIBITED_USE_POLICY.txt`. No Google endorsement is implied.

	---
	license: gemma
	base_model: google/gemma-3-1b-it
	library_name: peft
	language:
	- en
	tags:
	- lora
	- interpretability
	- instruction-following
	- research
	---

	# Restriction Learning Experiment

	The actual selective-restriction Gemma 3 1B adapter used by [LoRA-Forensics](https://huggingface.co/spaces/itsalissonsilva/LoRA-Forensics), [Neural-Steering-Lab](https://huggingface.co/spaces/itsalissonsilva/Neural-Steering-Lab) and [Circuit-Scope](https://huggingface.co/spaces/itsalissonsilva/Circuit-Scope). Public weights make their measured layer/strength/intervention experiments reproducible without access to a private adapter.

	The question is narrow: does the model withhold marked-private workspace values while still answering permitted requests? Every condition receives the same explicit policy. All workspaces and private values are synthetic. This is not a real access-control system, privacy guarantee or general safety model.

	## What it learned, and where it failed

	96 fixed requests: 84 policy cases from 12 held-out workspaces, eight public-label flips and four unrelated questions.

	\| Condition \| Pass exact automatic checks \| Allowed assistance checks \| Disclosures \|
	\|---\|---:\|---:\|---:\|
	\| Base Gemma \| 28/96 \| 28/48 \| 4 \|
	\| Selective adapter (root weights) \| 75/96 \| 39/48 \| 3 \|
	\| Blanket-refusal adapter \| 36/96 \| 0/48 \| 0 \|
	\| Matched random adapter \| 25/96 \| 25/48 \| 4 \|

	The selective adapter introduces three indirect disclosures on cases where the base did not disclose. Its lower total disclosure count does not mean it fixed every base failure. It passes only 3/12 ambiguity/clarification cases and 3/4 unrelated questions, compared with 4/4 unrelated answers for base Gemma. Its permitted-task gains coexist with specific regressions.

	Disclosure checks cover literal, reversed, base64 and whitespace-normalized synthetic canaries. Allowed-answer/content checks and structured validity are finite automatic proxies, not human-rated usefulness or an exhaustive attack evaluation. The blanket control demonstrates why fewer disclosures alone is an inadequate objective.

	## Training and controls

	Base revision `dcc83ea841ab6100d6b47a070329e1ba4cf78752`; rank16 Q/V LoRA, two fixed epochs, one seed, 784 examples (112 training workspaces × seven request types). Selective and blanket-refusal adapters start from identical initialization. Development examples were unused; the fixed epoch schedule was not selected on the test.

	Held-out templates and table/JSON record layouts test limited generalization. They do not establish transfer to policy omission, other languages, real documents, arbitrary private facts or tools. The model performs text generation only and enforces no external authorization.

	`selective/` preserves the original selective checkpoint; root weights are an identical copy for standard PEFT loading. `blanket/` preserves the over-refusal control. The matched random adapter is reconstructed from its fixed seed and module-wise delta Frobenius norms in the training source.

	## Layer and strength analysis

	`analysis/analysis.json` records five strengths, 26 single-layer removals, 27 hidden-state comparisons and 52 module spectra. Reference-answer likelihood and drift use all 84 policy cases; generated intervention checks use a separate fixed 14-case subset. Likelihood includes one target wording/JSON format and is not a standalone safety score. Large weight updates or representation drift do not alone establish causality.

	Matched-batch restoration gives 14/14 identical raw responses and exact likelihood restoration. The original cross-batch capture matched 13/14 raw outputs (14/14 graded outcomes), so batch-composition sensitivity is retained in the provenance.

	`interpretability_patchfix/patching.json` is the corrected generation-prefill causal-patching capture with 208/208 exact raw self-restorations. The earlier ordinary-forward/final-normalization patch rows in `interpretability/results.json` are superseded and must not be used as valid patching evidence. Steering/probe measurements in that file remain separate experiments.

	This is descriptive follow-up on already opened test data, with no significance or complete-circuit claim. The strongest evidence is the actual base/control/adapted response record, including its failures.

	## Run it

	Accept Gemma's base-model access terms and authenticate. Reproduction environment: PyTorch2.6.0, Transformers4.57.1, PEFT0.17.1, Accelerate1.10.1, SentencePiece0.2.1. Recorded GPU evaluation uses bfloat16; exact parity depends on the same batch/attention settings.

	Download `restriction.py`, then reproduce a permitted case:

	```python
	import json
	from huggingface_hub import hf_hub_download
	from restriction import RestrictionModel

	repo = "itsalissonsilva/Restriction-Learning-Experiment"
	report = json.load(open(hf_hub_download(repo, "restriction_results.json")))
	case = next(row for row in report["rows"] if row["kind"] == "public")
	print(case["context"], case["request"])
	model = RestrictionModel() # Pin revision to a release commit for a frozen run.
	print(model.respond_rows([case])[0])
	```

	For a new synthetic case, provide `context`, `request` and optionally `policy` in the same record format. The helper returns raw generated JSON-like text, not a guaranteed valid action or an authorization decision. It rejects overly long input rather than truncating the policy. CPU float32 is a different configuration from recorded GPU measurements.

	## Reproduce and license

	Training, data generation/grading, analysis, restoration, steering and corrected patching sources are included with fixed model revisions and measured results. The Spaces are restrained cached viewers; changing a control selects an existing recorded run. They do not run live inference.

	Research inspiration: [Meng et al., ROME / CounterFact](https://rome.baulab.info/) and its efficacy/generalization/specificity criteria. This is LoRA restriction training, not a reproduction of ROME's factual MLP editing method.

	Modified artifact notice: the adapter weights were trained by itsalissonsilva and modify Gemma. Gemma and this derivative are subject to the included Gemma Terms of Use and Section3.2 restrictions, including the incorporated Prohibited Use Policy. See `LICENSE`, `NOTICE` and `GEMMA_PROHIBITED_USE_POLICY.txt`. No Google endorsement is implied.